What is the right way to authenticate to the GCP Cloud Tasks enqueue API?

Question

I have this code:

import {v2beta3} from "@google-cloud/tasks";
const project = 'xxxxxxx'
const location = 'yyyyyyy'
const queue = 'zzzzzzzzz'

const client = new v2beta3.CloudTasksClient()
const parent = client.queuePath(project, location, queue)
const payload = {eventId: "fred"}
const convertedPayload = JSON.stringify(payload)
const body = Buffer.from(convertedPayload).toString('base64');
const task = {
  httpRequest: {
    httpMethod: "POST",
    url: "https://webhook.site/9sssssssssss",
    oidcToken: {
      serviceAccountEmail: "aaaaaaaaaa@appspot.gserviceaccount.com",
    },
    headers: {
      'Content-Type': 'application/json',
    },
    body,
  },
};

(async function() {
  try {
    const [response] = await client.createTask({parent, task});
    console.log(`Created task ${response.name}`);
  } catch (error) {
    console.log(error)
  }
}());

When I run it from my laptop, it just works, which seems unauthenticated to me. Anyone can now enqueue a task on my queue.

What is the right way to authenticate to the GCP Cloud Tasks enqueue API?

Answer 1

As John Hanley pointed out in the comments, my local app was using Application Default Credentials to authenticate itself. When I switched to a different gcloud account by doing this:

gcloud auth application-default login

I get this error message when I try to run the code:

Error: 7 PERMISSION_DENIED: The principal (user or service account) lacks IAM permission "cloudtasks.tasks.create" for the resource "projects/yyyyyyy/locations/europe-west1/queues/default-xxxxxx" (or the resource may not exist).